INSPECTOR  GENERAL 
DEPARTMENT  OF  DEFENSE 
400  ARMY  NAVY  DRIVE 
ARLINGTON,  VIRGINIA  22202-4704 


June  10,  2004 

MEMORANDUM  FOR  INSPECTOR  GENERAL,  NATIONAL  RECONNAISSANCE  OFFICE 

SUBJECT :  Quality  Control  Review  of  the  Assistant  Inspector  General  for  Audits 
Office  of  the  Inspector  General,  National  Reconnaissance  Office 
(Report  No.  D2004-6-005) 


We  have  reviewed  the  Office  of  the  Assistant  Inspector  General  for  Audits  (OAIGA), 
Office  of  the  Inspector  General,  National  Reconnaissance  Office  (NRO)  system  of  quality  control 
for  the  year  ended  July  3 1 , 2003.  The  Government  Auditing  Standards  require  that  an  audit 
organization  performing  Government  audits  have  an  appropriate  internal  quality  control  system 
and  undergo  an  external  quality  control  review  every  3  years  by  an  organization  that  is  not 
affiliated  with  the  organization  reviewed.  As  the  organization  that  has  audit  policy  and  oversight 
responsibilities  for  audits  in  the  DoD,  we  facilitated  and  oversaw  the  conduct  of  this  quality 
control  review  of  the  NRO  OAIGA.  To  avoid  unnecessary  duplication  and  disruption,  we 
conducted  the  audit  quality  control  review  of  NRO  OAIGA  concurrently  with  the  management 
review  of  the  NRO  Office  of  the  Inspector  General.  The  Office  of  the  Deputy  Inspector  General 
for  Intelligence,  Office  of  the  Inspector  General  of  the  Department  of  Defense,  jointly  conducted 
the  management  review  with  the  Office  of  the  Inspector  General,  Central  Intelligence  Agency. 

An  audit  organization’s  quality  control  policies  and  procedures  should  be  appropriately 
comprehensive  and  suitably  designed  to  provide  reasonable  assurance  of  meeting  the  objectives 
of  quality  control.  We  tested  the  OAIGA  system  of  quality  control  to  the  extent  considered 
appropriate. 

The  NRO  OAIGA  designed  their  system  of  quality  control  in  effect  for  the  year  ended 
July  31, 2003,  in  accordance  with  quality  standards.  They  also  complied  with  the  system  to 
provide  reasonable  assurance  of  material  compliance  with  professional  auditing  standards  in 
conducting  its  audits.  Therefore,  we  are  issuing  an  unqualified  opinion  on  the  audit  quality 
control  system.  The  scope  and  methodology  of  our  review  is  at  Appendix  A.  Comments  and 
observations  that  did  not  affect  the  overall  opinion  and  recommendations  for  corrective  actions 
are  at  Appendix  B  and  should  be  read  in  conjunction  with  the  report. 

The  Inspector  General  NRO  provided  comments  to  a  draft  of  this  report,  which  are 
attached.  We  considered  his  comments  when  preparing  the  final  report.  Please  provide 
comments  and  planned  corrective  actions  to  the  revised  recommendations  on  page  6  and  clarify 
comments  to  the  recommendation  on  page  9  of  Appendix  B  by  July  26, 2004.  Please  call  Ms. 
Carolyn  R.  Davis  at  (703)  604-8877  if  you  have  any  questions.  See  Appendix  C  for  the  report 
distribution. 
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Appendix  A.  Scope  and  Methodology 


The  mission  of  the  NRO  is  to  develop  and  operate  unique  and  innovative  space 
reconnaissance  systems  and  conduct  intelligence-related  activities  essential  for  the  national 
security  of  the  United  States.  The  Director,  NRO,  delegated  the  authority  and  responsibility  to 
conduct  audits  within  the  NRO  to  the  Inspector  General  (IG),  NRO.  Personnel  within  the  NRO 
Office  of  the  Assistant  Inspector  General  for  Audits  (OAIGA)  execute  the  audits  within  NRO. 
The  OAIGA  is  responsible  for  enhancing  economy,  efficiency,  effectiveness,  and  accountability 
within  the  NRO  by  perfonning  independent  audits  of  NRO  operations  and  programs.  The 
OAIGA  also  makes  recommendations  to  correct  problems  and  deficiencies  identified  by  the 
independent  audits;  keeps  the  Director,  NRO,  informed;  and  promotes  effectiveness  in  the 
administration  of  NRO  operations  and  programs.  The  NRO  Inspector  General  Audit  Policy  & 
Procedures  Manual,  dated  May  1 ,  2000,  and  the  Draft  National  Reconnaissance  Office  Inspector 
General  Audit  Policy  &  Procedures  Manual,  dated  March  2003,  provide  guidance  on  the 
operation  of  audits  within  the  NRO  OAIGA. 

The  review  team  tested  compliance  with  the  OAIGA  system  of  quality  control  to  the 
extent  considered  appropriate.  The  tests  included  reviewing  a  judgmental  sample  of  six  of  nine 
audit  reports  issued  by  the  NRO  OAIGA  during  the  year  ended  July  31,  2003. 

From  July  2003  through  January  2004,  the  external  review  team  conducted  a  review  of 
the  audit  quality  control  function  for  the  NRO  Office  of  the  Inspector  General  in  effect  for  the 
period  from  August  1,  2002,  through  July  31,  2003.  The  team  used  the  guidelines  and  checklists 
established  by  the  President’s  Council  on  Integrity  and  Efficiency  as  amended  February  2002  to 
ensure  that  the  review  was  in  conformance  with  GAS.  The  review  team  adjusted  the  President's 
Council  on  Integrity  and  Efficiency  (PCIE)  guidelines  and  checklists  as  appropriate.  In  applying 
the  PCIE  guidelines,  the  review  team  considered  several  factors  such  as  the  size  of  the  OAIGA, 
the  degree  of  autonomy  allowed,  and  the  nature  of  the  work.  The  review  team  reviewed  working 
papers  for  the  selected  audits,  conducted  interviews  of  professional  and  administrative  staff 
members,  and  performed  tests  of  documentation. 

We  used  the  1994  version  of  the  Government  Auditing  Standards,  as  amended,  including 
the  amendment  of  the  Independence  Standard,  which  became  effective  in  January  2003.  Where 
appropriate  we  have  provided  suggestions  for  modifying  operating  procedures  based  on  the  2003 
version  of  the  Government  Auditing  Standards,  which  became  effective  January  1,  2004. 

Limitations  of  Review.  Our  review  would  not  necessarily  disclose  all  weaknesses  in 
the  system  of  quality  control  or  all  instances  of  noncompliance  with  it  because  we  based  our 
review  on  selective  tests.  There  are  inherent  limitations  in  considering  the  potential 
effectiveness  of  any  quality  control  system.  In  performing  most  control  procedures,  departures 
can  result  from  misunderstanding  of  instructions,  mistakes  of  judgment,  carelessness,  or  other 
human  factors.  Projecting  any  evaluation  of  a  quality  control  system  into  the  future  is  subject  to 
the  risk  that  one  or  more  procedures  may  become  inadequate  because  conditions  may  change  or 
the  degree  of  compliance  with  procedures  may  deteriorate. 

Review  Team  Composition.  The  audit  quality  control  system  review  team  consisted  of 
representatives  from  the  Offices  of  the  Assistant  Inspectors  General  for  Auditing,  the  National 
Geospatial-Intelligence  Agency,  the  National  Security  Agency,  and  the  Central  Intelligence 
Agency  (CIA).  The  Office  of  the  Assistant  Inspector  General  for  Audit  Policy  and  Oversight, 
DoD  provided  oversight  and  prepared  the  report. 
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Acronyms 

CIA 

Central  Intelligence  Agency 

GAS 

Government  Auditing  Standards 

IPA 

Independent  Public  Accountant 

NRO 

National  Reconnaissance  Office 

OAIGA 

Office  of  the  Assistant  Inspector  General  for  Audits 

OPM 

Office  of  Personnel  Management 

PCIE 

President’s  Council  on  Integrity  and  Efficiency 

RFP 

Request  for  Proposal 

SOW 

Statement  of  Work 
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Appendix  B.  Comments  and  Observations 


Based  on  our  review,  we  have  the  following  comments,  observations,  and 
recommendations.  These  comments  and  observations  did  not  affect  our  overall  unqualified 
opinion.  However,  the  NRO  OAIGA  needs  to  continue  its  diligence  to  maintain  an  effective 
system.  Implementing  the  recommendations  would  improve  the  quality  control  system  and  help 
to  maintain  an  unqualified  opinion.  We  received  comments  from  the  IG,  NRO  on  a  draft  of  this 
report.  We  have  made  changes  accordingly,  summarized  the  comments  below,  and  included  a 
copy  of  the  comments. 

Qualification  Requirements  for  National  Reconnaissance  Office  Audit  Staff.  The  NRO  staff 
collectively  possessed  professional  proficiency  to  perform  the  audits.  However,  we  identified 
one  member  of  the  OAIGA  staff  who  was  classified  as  an  auditor  but  did  not  meet  the  usual 
requirements  for  an  auditor  position. 

The  individual  had  two  degrees,  one  in  Political  Science  and  one  in  International 
Relations,  and  had  19  years  of  information  technology  experience.  The  individual  lacked 
accounting  or  audit  education  and  experience  before  taking  this  position.  We  were  told  that  the 
OAIGA  uses  the  CIA  qualifications  standards,  so  we  contacted  the  CIA  Human  Resources  office 
to  obtain  a  copy  of  their  auditor  qualification  standards.  The  CIA  Human  Resources  office 
referred  us  to  the  Assistant  Inspectors  General  for  Audits  for  CIA  and  NRO.  Office  of  the 
Inspector  General  CIA  personnel  had  previously  provided  us  with  three  CIA  job  announcements 
that  we  were  told  included  basic  auditor  qualifications.  Based  on  the  three  job  announcements, 
the  basic  qualifications  for  auditor  positions  are: 

•  a  college  degree  in  accounting,  finance,  information  systems,  or  business 
management  with  a  solid  academic  record.  Applicants  were  required  or  encouraged 
to  have  a  degree  with  a  major  in  one  of  these  disciplines. 

•  2  to  5  years  experience  in  conducting  or  participating  in  audits  of  Federal  financial 
statements  or  in  government  auditing,  accounting,  or  information  systems  as 
preferred  or  required. 

The  job  announcements  ranged  in  grades  from  GS-9  through  GS-13  with  career  growth  potential 
to  GS-15  and  beyond.  The  OAIGA  hired  the  individual  in  question  as  a  GS-14  although  that 
individual  did  not  meet  any  of  the  basic  auditor  qualifications  that  we  were  given. 

The  OAIGA  stated  that  it  uses  its  own  job  announcements,  which  it  did  in  this  case  to 
hire  the  individual.  The  qualification  standards  for  the  job  announcement  against  which  the 
individual  in  question  was  hired  were: 

•  a  college  degree  and  specialized  experience  in  work,  which  will  enable  the  applicant 
to  perform  successfully  the  duties  of  the  position,  and 

•  experience  typically  related  to  such  things  as  evaluating  compliance  with  laws  and 
regulations,  or  assessing  the  effectiveness,  economy  and  efficiency  of  resource 
utilization;  management  processes  and  procedures;  and  in  achieving  mission 
objectives. 


3 


OAIGA  can  and  should  have  technical  specialists  to  provide  specific  knowledge  and 
skills,  such  as  information  technology.  However,  we  believe  that  the  NRO  OAIGA  should  have 
well-defined  and  consistent  qualification  standards  for  hiring  its  auditors. 

The  Government  Auditing  Standards  require  that  the  audit  team  collectively  possess 
adequate  professional  competence  for  the  tasks  assigned.  Although  the  Government  Auditing 
Standards  do  not  address  qualifications  for  auditors  or  other  specialists  in  an  audit  organization, 
the  designation  of  auditor  has  specific  expectations  of  education  and  experience  in  the 
Government  auditing  community.  Like  the  Government  Auditing  Standards,  the  PCIE  in  the 
“Quality  Standards  for  Federal  Offices  of  Inspector  General,”  October  2003,  paragraph  VIII.  C., 
Core  Competencies,  states  that  staff  members  must  collectively  possess  the  professional 
competence  to  perform  the  work  assigned.  However,  the  PCIE  standards  further  state  that  “staff 
must  individually  meet  requirements  established  by  the  Office  of  Personnel  Management  (OPM) 
for  their  respective  job  series  and  by  applicable  professional  standards.”  The  OPM  requirements 
for  auditors  are  a  degree  in  accounting  or  related  field  such  as  business  administration,  finance, 
or  public  administration  that  includes  or  is  supplemented  by  24  semester  hours  in  accounting. 

The  OPM  requirements  for  auditors  allow  for  a  combination  of  education  and  experience  that 
includes  at  least  4  years  of  experience  in  accounting  or  an  equivalent  combination  of  accounting 
experience,  college-level  education,  and  training  that  provides  knowledge  of  professional 
accounting. 

Both  the  IG  DoD  and  the  IG  CIA  are  members  of  the  PCIE.  Because  NRO  operates 
under  both  DoD  and  CIA  authorities,  we  believe  that  the  OAIGA  should  adopt  the  PCIE 
qualification  standard  for  its  auditor  positions.  Such  an  action  is  consistent  with  other  Federal 
audit  organizations,  which  have  personnel  systems  that  do  not  follow  OPM  guidelines,  but  use 
the  OPM  standards  for  auditors  within  their  organizations  and  use  other  designations  for 
positions  that  do  not  meet  those  qualifications. 

Recommendation.  We  recommend  that  the  Assistant  Inspector  General  for  Audits, 
Office  of  the  Inspector  General,  National  Reconnaissance  Office: 

•  Re-designate  the  individual  who  does  not  meet  the  basic  auditor  requirements  to  a 
position  designation  more  in  line  with  the  individual’s  education  and  experience. 

•  Establish  consistent  minimum  qualifications  of  its  staff  members  in  accordance  with 
PCIE  standards. 

Management  Comments.  In  a  response  to  a  draft  of  this  report,  the  IG  NRO 
nonconcurred  with  the  recommendation  to  re-designate  the  individual  stating  that  neither  the 
new  nor  prior  CIA  personnel  management  systems  allowed  them  to  do  so.  The  IG  NRO 
maintains  that  the  individual  meets  the  OPM  defined  standard.  The  IG  NRO  concurred  in 
principle  with  the  recommendation  to  establish  consistent  minimum  qualifications  stating  that 
any  vacancy  announcements  will  include  minimum  education  qualifications  as  well  as  audit 
experience  requirements  for  the  entry  through  expert  level  auditor. 

Our  Response.  After  reviewing  additional  infonnation  provided  by  the  AIGA,  we 
continue  to  disagree  that  the  one  auditor  met  the  OPM  requirements  as  an  auditor  and  continue  to 
believe  that  the  individual  did  not  meet  the  “usual”  qualifications  for  an  auditor  as  used  by  the 


The  Executive  Council  on  Integrity  and  Efficiency,  which  includes  non-statutory  Federal  Inspectors  General,  are 
also  a  party  to  the  Quality  Standards  for  Federal  Offices  of  Inspector  General. 
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CIA.  We  continue  to  believe  that  the  IG  and  AIGA  could  best  serve  the  NRO  audit  organization 
by  working  with  the  CIA  personnel  management  staff  to  determine  a  way  to  include  subject 
matter  experts  within  the  audit  office  if  future  requirements  dictate,  rather  than  hire  someone  as 
an  auditor  without  minimum  qualifications.  Although  the  IG  NRO  did  not  opt  to  implement  the 
PCIE  standard  to  use  the  OPM  requirements  for  its  auditors,  they  have  indicated  that  they  have 
minimum  qualifications  that  will  be  used  to  hire  auditors.  The  identification  of  minimum 
qualification  standards  for  the  different  “grade”  levels  and  the  consistent  application  of  those 
qualification  standards  when  recruiting  and  hiring  auditors  meets  the  intent  of  our 
recommendation.  However,  we  believe  that  AIGA  should  not  establish  auditor  qualification 
standards  that  are  significantly  different  from  qualification  standards  used  by  other  Government 
audit  organizations.  Other  audit  organizations  within  the  PCIE/ECIE  community  and  the 
General  Accounting  Office  use  the  OPM  standards  when  designating  someone  as  an  “auditor.” 
However,  they  recognize  that  other  education  and  experiences  are  appropriate  to  provide 
competent  staff  for  their  audits  and  will  hire  other  staff  other  than  “auditors,”  but  they  generally 
designate  the  individuals  as  something  other  than  auditor,  such  as  evaluator. 

Qualifications  of  Independent  Public  Accountant  Staff.  Section  L  of  the  Request  for 
Proposal  (RFP)  for  the  contract  on  the  NRO  FY  2002  Financial  Statements  Audits  established 
minimum  “satisfactory”  qualifications  of  education  and  experience  for  the  Independent  Public 
Accountant  (IP A)  staff  -  Project  Manager  and  three  key  audit  positions.  The  minimum 
contractual  educational  and  experience  requirements  for  key  positions  #2  and  #3  were  either 
CPA  or  meet  the  CPA  educational  requirements  in  the  state  employed,  bachelors  degree  in 
accounting  or  business,  and  a  minimum  of  5  years  and  2  years,  respectively,  of  general  audit 
experience,  with  desired  experience  in  CFO  audit  work.  In  addition,  RFP  Clause  1-12  specified 
that  all  proposed  substitutes  for  the  key  personnel  must  have  “qualifications  that  are  equal  to  or 
higher  than  the  qualifications  of  the  person  to  be  replaced.” 

For  the  NRO  financial  statement  audit,  the  IPA  contractor  had  a  pattern  of  replacing  staff 
with  other  staff  with  lower  qualifications  despite  the  requirements.  For  key  position  #2,  the 
OAIGA  accepted  a  replacement  that  did  not  meet  the  contract  requirements  because  the  IPA 
stated  that  they  had  no  other  staff  available  to  put  on  the  NRO  financial  statement  audits.  For 
key  position  #2,  the  reduced  requirements  were  offset  somewhat  because  the  auditor  had  prior 
experience  with  NRO  financial  statement  audits.  For  key  position  #3,  the  OAIGA  accepted  a 
replacement  that  met  the  requirements  for  education  and  experience  but  did  not  satisfy  the 
Clause  1-12  requirement  for  equal  to  or  higher  than  the  person  replaced. 

Given  that  two  key  personnel  did  not  fully  meet  the  requirements  in  the  RFP,  additional 
quality  control  reviews  could  provide  increased  assurance  of  the  adequacy  of  the  work. 
According  to  NRO  audit  staff,  as  a  condition  of  accepting  an  individual  without  the  same  or 
higher  qualifications,  the  person  in  key  position  #1  increased  the  number  of  hours  so  that  NRO 
IG  would  be  comfortable  with  the  level  of  supervision  on  the  audit.  This  was  in  accordance  with 
the  statement  of  work  (SOW)  section  9.3,  which  requires  the  contractor  to  provide  sufficient 
senior  qualified  personnel  to  review  working  papers  and  direct  senior  and  junior  auditors. 

OAIGA  staff  indicated  that  they  will  reassess  the  key  personnel  clause  for  future 
contracted  audit  services  to  determine  whether  the  qualification  requirements  are  appropriate. 
They  expressed  an  intention  to  consider  lowering  the  qualification  requirements  as  opposed  to 
having  the  IPA  meet  the  current  minimum  certification,  education,  and  experience  requirements. 
We  believe  the  current  “satisfactory”  requirements  delineated  in  the  RFP  for  IPA  staff  are 
reasonable.  We  also  believe  that  Clause  1-12,  is  potentially  in  conflict  with  Section  L,  key 
personnel  requirements. 
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Recommendation.  Along  with  reassessing  the  appropriate  level  of  audit  education, 
experience,  and  certification  for  Independent  Public  Accountant  staff,  we  recommend  that  the 
Assistant  Inspector  General  for  Audits  in  preparing  the  RFP  and  contract  for  the  next  contract  for 
financial  audit  services  work  with  the  NRO  acquisition  and  contracting  officials  to: 

•  Establish  RFP  requirements  that  reflect  the  intent  and  need  to  obtain  qualified 
contract  audit  staff  and  maintain  the  qualified  staff  throughout  the  contract 
performance;  and 

•  Ensure  that  statement  of  work  contains  the  same  material  clauses  as  the  RFP 
regarding  contract  personnel  qualifications  and  substitution  and  replacement  clauses. 

Management  Comments.  In  response  to  a  draft  of  this  report,  the  IG  NRO  concurred  in 
principle  with  the  recommendations  to  establish  procedures  for  additional  oversight  and  include 
contract  provisions  for  additional  oversight.  However,  they  stated  that  the  existing  SOW 
includes  adequate  procedures.  They  will  reexamine  the  procedures  before  issuing  the  next 
contract.  The  IG  NRO  nonconcured  with  the  recommendations  to  delete  Clause  1-12  because 
the  NRO  Acquisition  Manual  requires  the  clause.  They  also  nonconcurred  with  the  need  to 
modify  the  contract  because  the  current  contract  ends  in  January  2005. 

Our  Response.  We  revised  our  recommendation  based  on  the  IG  comments  and 
subsequent  information  requested  in  conjunction  with  those  comments.  We  request  that  the  IG 
NRO  provide  comments  to  the  revised  recommendations. 

Based  on  our  review  of  the  referenced  SOW  clauses,  we  disagree  that  the  clauses  meet 
the  intent  of  our  recommendation  to  establish  additional  oversight  procedures  or  actions  if  the 
contractor  does  not  meet  the  contractual  requirements,  nor  was  there  consideration  for  not 
meeting  the  contract  requirements  on  qualifications  of  substituted  personnel.  The  referenced 
clauses  give  the  contractor  supervision  and  management  requirements  for  contract  compliance. 
We,  however,  deleted  those  recommendations  in  light  of  revised  recommendations  as  discussed 
below.  In  the  future,  the  NRO  OAIGA  staff  should  work  with  the  contracting  officer  to  ensure 
that  the  contractor  meets  the  contractual  requirements. 

Our  review  of  the  Acquisition  Manual  requirements  does  not  support  the  IG  comment 
that  the  manual  requires  the  Clause  1-12.  The  Acquisition  Manual  states  “Because  of  the 
restrictive  nature  of  the  requirement,  the  detennination  to  use  this  clause  should  be  made  only  in 
exceptional  cases.”  We  do  not  believe  that  such  a  statement  implies  that  the  clause  is  required. 
Also,  the  Clause  1-12  is  different  from  the  SOW  clause  9.4.  Clause  1-12  was  more  restrictive 
than  what  was  included  in  the  SOW.  Clause  1-12  required  that  a  substituted  key  person  have 
equal  to  or  higher  qualifications  than  the  person  replaced.  The  SOW  clause  9.4,  Substitution 
and  Rotation  of  Personnel,  stated  that  proposed  personnel  replacements  must  meet  or  exceed  the 
minimum  professional  experience,  qualifications,  capabilities,  and  security  clearances  required 
by  this  contract.  Also,  the  SOW  clause  9.4  did  not  include  or  define  the  “minimum” 
professional  experience,  qualifications  and  capabilities.  However,  the  RFP  gave  “satisfactory 
requirements”  for  the  key  positions  in  the  RFP. 

We  recognize  that  there  are  a  number  of  ways  to  originally  assemble  a  competent  audit 
team  for  the  contract  and  to  retain  the  competency  of  the  team.  However,  when  the 
qualifications  in  the  RFP  do  not  match  up  with  the  SOW,  or  the  contract  requirements  are  not 
enforced,  offerors  that  lost  the  competition  could  question  the  fairness  of  the  solicitation.  The 
SOW  becomes  the  binding  document  and  it  should  contain  important  provisions  from  the  RFP. 
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We  believe  minimum  qualifications  for  auditors  and  managers  of  the  financial  statement  audit 
contract  are  a  material  factor  and  important  to  the  competition  and  to  the  performance  of  the 
audit.  We  also  believe  that  the  substitution  clause  should  be  the  same  in  the  RFP  and  the  SOW. 
We  continue  to  believe  that  the  minimum  qualification  requirements  in  the  RFP  and  the 
requirements  of  Clause  1-12  are  potentially  contradictory.  The  AIGA  has  stated  that  they  are 
reassessing  the  minimum  auditor  requirements  to  have  a  successful  adequate  audit  of  the  NRO 
financial  statements  audits  in  accordance  with  Government  Auditing  Standards.  In  conjunction 
with  the  reassessment,  we  believe  that  the  OAIGA  should  work  with  the  NRO  acquisition  and 
contracting  staff  to  reassess  how  best  to  ensure  that  the  audit  team  will  meet  the  NRO  needs  and 
what  substitution  requirements  are  appropriate.  They  should  also  work  with  the  NRO 
acquisition  and  contracting  staff  to  ensure  that  the  RFP  and  the  SOW  are  consistent.  We  have 
revised  our  recommendations  to  reflect  the  IG  comments  and  analysis  of  additional  infonnation 
provided. 


The  contractor  did  not  meet  the  terms  of  the  contract  in  relation  to  staff  qualifications  for 
new  staff  assigned  to  the  team.  We  intended  our  recommendation  to  modify  the  contract  in  the 
event  of  changes  in  its  terms  and  conditions  for  future  contracts  as  well  as  the  current  contract. 

If  the  terms  and  conditions  are  changed  without  appropriate  contract  modifications,  NRO  is 
potentially  at  risk  in  contract  close  out  and  future  contract  actions.  We  have  deleted  the 
recommendation  related  to  modifying  the  contract  because  we  believe  that  the  revised 
recommendations  if  properly  implemented,  can  eliminate  the  issues  we  identified.  However, 
NRO  must  ensure  that  the  contractor  comply  with  the  terms  and  conditions  of  the  contracts; 
otherwise,  a  modification  is  necessary. 

Auditor  Independence.  The  revision  to  the  Government  Auditing  Independence  Standard, 
effective  January  2003,  significantly  strengthened  the  standard.  The  Comptroller  General  stated 
that  “protecting  the  public  interest  and  ensuring  public  confidence  in  the  independence  of 
auditors  of  government  financial  statements,  programs,  and  operations,  in  both  form  and 
substance”  were  paramount  in  his  decision  to  issue  these  new  standards.  The  standard  requires 
that  the  audit  organization  have  an  internal  quality  control  system  in  place  to  help  determine 
whether  auditors  have  any  personal  impairment  to  independence  that  could  affect  their 
impartiality  or  the  appearance  of  impartiality.  Auditors  are  responsible  for  notifying  the 
appropriate  officials  within  their  audit  organizations  if  they  have  any  personal  impairment  to 
independence.  The  revision  also  significantly  strengthened  the  standard  as  it  relates  to  non-audit 
work. 

NRO  Staff  Independence  Guidance.  The  NRO  Office  of  the  Inspector  General  Audit  Manual 
placed  responsibility  on  auditors  to  notify  the  Assistant  Inspector  General  for  Audits  or  other 
Office  of  the  Inspector  General  management  official  in  writing  of  any  personal  impairment  to 
their  independence.  The  Auditor-in-Charge  (supervisor)  is  responsible  to  ensure  that  the  audit 
file  addresses  the  requirement  and  includes  evidence  of  compliance.  We  identified  two  instances 
where  documentation  in  the  working  papers  identified  that  auditors  notified  their  supervisors  of 
conflicts  of  interest.  The  analysis  of  the  independence  issue  was  in  the  working  papers.  The 
OAIGA  Quality  Checklist  addresses  after-the-fact  independence  issues  by  questioning  working 
paper  contents  on  impairments  and  report  disclosure.  However,  given  the  emphasis  on  audit  and 
audit  organization  independence  in  recent  years  both  within  and  outside  Government,  we  believe 
that  NRO  should  consider  a  more  proactive  approach  to  its  independence  quality  control 
processes.  For  example,  two  common  ways  used  in  other  audit  organizations  are  that:  (1) 
auditors  certify  at  the  beginning  of  an  audit  to  personal  independence  relative  to  that  audit  and 
(2)  auditors  include  a  certification  as  part  of  their  time/attendance  documentation  to  their 
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personal  independence  relative  to  audit(s)  or  other  projects  worked  on  during  that  pay  period.  In 
either  case,  the  policy  should  require  that  the  auditors  notify  their  supervisors  of  any  changes 
subsequent  to  certification  and  that  appropriate  action  be  taken.  According  to  the  Assistant 
Inspector  General  for  Audits,  the  audit  staff  has  begun  to  document  auditor  independence  at  the 
outset  of  an  audit.  The  quality  control  process  should: 

•  stress  the  “in  fact  and  appearance”  aspects  of  independence; 

•  address  potential  actions  or  mitigating  factors  to  consider  when  deciding  on 
appropriate  actions  to  take  if  potential  impairments  to  independence  issues  are 
identified;  and 

•  address  the  need  to  include  any  pertinent  issues  related  to  independence  impairments 
in  the  scope  and  methodology  section  of  the  audit  reports. 

The  NRO  Inspector  General  Audit  Policy  and  Procedures  Manual  also  does  not  address  the 
impairment  to  both  personal  and  organizational  independence  for  non-audit  work,  and  the 
safeguards  that  must  be  put  in  place  if  non-audit  work  is  done. 

Recommendation.  We  recommend  that  the  Assistant  Inspector  General  for  Audits 
revise  and  strengthen  procedures  to  provide  more  proactive  quality  control  measures  to  comply 
with  the  GAS  independence  standard  and  include  procedures  and  processes  to  safeguard 
personal  and  organizational  independence  related  to  non-audit  work.  Such  procedures  could 
include: 

•  providing  guidance  for  the  proper  use  and  reporting  of  scope  limitations  when 
independence  is  impaired; 

•  providing  procedures  when  non-audit  services  have  been  performed  for  the  audit 
client;  and 

•  providing  procedures  if  changes  in  independence  occur. 

Management  Comments.  The  IG  NRO  concurred  with  the  recommendation. 

IPA  Independence  Documentation  Requirements.  The  contractor  staff  that  performed  the 
financial  statement  audit  signed  a  contractor  form,  Independence  Confirmation  for  US 
Engagement  Personnel.  This  form  is  a  standard  form  for  this  particular  contractor  and  does  not 
speak  to  nor  cite  GAS.  The  form’s  focus  is  toward  an  audit  of  a  non-government  organization 
although  it  indicates  “...applicable  rules  with  respect  to  the  National  Reconnaissance  Office.” 
The  form  addresses  some  but  not  many  of  the  independence  elements  included  in  GAS.  For 
example,  the  form  does  not  address  preconceived  ideas  toward  individuals,  groups, 
organizations,  or  objectives  of  a  particular  program  that  could  bias  the  audit;  biases,  including 
those  induced  by  political  or  social  convictions,  that  result  from  employment  in,  or  loyalty  to,  a 
particular  group,  organization,  or  level  of  government;  or  relevant  non-audit  work.  OAIGA 
believes  that  the  security  requirements  used  by  NRO,  including  the  polygraph  examination, 
provide  assurance  of  an  employee’s  honesty  and  integrity,  and  the  thorough  background 
investigation  that  an  IPA  employee  must  undergo  gives  additional  credence  that  the  employee  is 
meeting  independence  standards  in  regard  to  preconceived  ideas.  We  agree  with  the  AIGA  that 
a  certification  does  not  necessarily  have  to  cover  all  possible  actions,  but  it  should  explicitly 
address  GAS  and  non-audit  work. 
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In  his  January  2002  press  release  issuing  the  new  Government  Auditing  Standards  on 
independence,  the  Comptroller  General  of  the  United  States  urged  the  American  Institute  of 
Certified  Public  Accountants  to  raise  its  standards  to  those  contained  in  Government  Auditing 
Standards.  Therefore,  NRO  should  have  procedures  to  ensure  that  its  contractors  comply  with 
the  intent  of  the  Government  independence  standards  “in  both  fact  and  appearance.” 

Recommendation.  We  recommend  that  the  Assistant  Inspector  General  for  Audits 
include  in  its  RFP  and  contracts  for  audit  services  specific  requirements  for  complying  with  the 
Government  Auditing  Standard  on  Independence  and  required  documentation  to  ensure  that  the 
organization  as  well  as  the  individual  auditors  are  complying  with  the  independence  standard. 
The  RFP  and  statement  of  work  should  include  compliance  with  standards  related  to  non-audit 
work  by  both  the  organization  and  individual  auditors  related  to  the  audit  objectives  and  NRO. 

Management  Comments.  The  IG  NRO  concurred  with  the  recommendation.  However, 
the  IG  NRO  further  stated  that  the  IPA  would  not  be  performing  non-audit  work  as  part  of  this 
contract. 

Our  Response.  The  proposed  action  is  partially  responsive  to  our  recommendation.  The 
comments  indicate  a  misunderstanding  of  the  recommended  action;  therefore,  we  request  the  IG, 
NRO  reassess  and  clarify  his  comments  to  this  recommendation.  The  purpose  of  the 
recommendation  is  to  ensure  that  potential  contractors  specifically  address  potential  impairments 
to  independence  based  on  non-audit  work  that  the  IPA  performed  or  plans  to  perform  as  a  part  of 
other  contract(s)  or  work  done,  not  just  the  contract  in  process.  For  example,  the  IPA  or  a  IPA 
staff  assigned  to  the  contract  could  have  performed  non-audit  work  for  another  NRO 
organization  that  is  material  or  significant  to  the  NRO  financial  statements.  Therefore,  we 
reiterate  the  need  for  the  contractor  to  specifically  address  the  non-audit  work  by  both  the 
organization  and  the  individual  auditors.  The  contractor  should  be  required  to  identity  any  non¬ 
audit  work  that  the  contractor  or  their  assigned  staff  have  done  or  plan  to  do  that  could  relate  to 
the  audit  objectives  or  organizations  that  the  contractor  will  audit.  The  NRO  OAIGA  can  then 
determine  if  non-audit  work  is  material  or  significant  and  take  appropriate  actions,  which  could 
include  qualify  the  audit  report,  institute  safeguards,  or  disqualify  the  contractor  or  individual 
staff  member. 

Financial  Statement  Audit-Contractor  Oversight  and  Quality  Assurance  Working  Papers 
and  Quality  Assurance  Plan.  The  Acting  NRO  Inspector  General  transmitted  the  FY  2002 
financial  statements  audit  report  by  a  memorandum  in  which  he  stated  that  the  audit  was  done  in 
accordance  with  standards  and  that  he  agreed  with  the  IPA  opinion.  However,  the  majority  of 
NRO  Office  of  the  Inspector  General  contractor  oversight  and  quality  assurance  working  papers 
were  not  prepared  and  reviewed  until  after  the  audit  report  on  the  FY  2002  financial  statements 
and  the  transmittal  memorandum  agreeing  with  the  conclusions  were  issued  in  January  2003. 

The  2003  version  of  GAS  emphasizes  “Audit  documentation  should  contain  support  for  findings, 
conclusions,  and  recommendations  before  auditors  issue  their  report.”  Although  not  technically 
an  audit,  we  believe  that  the  concept  applies  to  the  contract  oversight  documentation  for  the 
financial  statement  audit. 

The  quality  assurance  plan  for  the  financial  statement  audit,  which  was  very  detailed  and 
rigorous,  included  both  oversight  steps  conducted  during  the  audit  and  quality  assurance 
procedures  that  were  completed  after  the  audit  report  was  issued.  The  oversight  section  should 
reflect  the  GAO/PCIE  Financial  Audit  Manual,  section  650,  “Using  the  Work  of  Others.”  The 
NRO  Office  of  the  Inspector  General  can  ensure  the  quality  of  the  audit  by  completing  and 
documenting  steps  similar  to  those  required  in  GAO/PCIE  section  650,  “Using  the  Work  of 
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Others,”  before  issuing  the  transmittal  memorandum  attesting  to  its  agreement  with  the  IPA  audit 
results.  The  staff  can  do  the  additional  quality  assurance  reviews  steps  after  the  report  is  issued 
and  form  the  basis  for  best  practices  or  lessons  learned. 

Although  we  recognize  the  strict  statutory  requirements  and  timelines  placed  on  financial 
statement  opinion  audits,  the  oversight  working  papers  that  support  the  endorsement 
memorandum  and  oversight  report  and  verify  execution  of  the  GAO/PCIE  Financial  Audit 
Manual  Section  650  steps  should  be  completed  before  issuing  the  report.  We  also  recognize  that 
NRO  OAIGA  staff  was  substantially  overseeing  the  work  that  IPA  performed  during  the  course 
of  the  IPA  audit.  NRO  OAIGA  staff  should  complete  the  documentation  of  contract  oversight 
review  of  the  IPA  work  before  issuing  its  conclusion  concerning  the  adequacy  of  the  IPA  work 
in  the  audit  report. 

Recommendation.  We  recommend  that  the  Assistant  Inspector  General  for  Audits 
revise  its  oversight  procedures  to  (1)  ensure  that  documentation  of  its  oversight  is 
complete  before  issuing  its  transmittal  report  accepting  the  contractor’s  opinions, 
conclusions,  and  recommendations  and  (2)  perform  quality  assurance  procedures  after 
report  issuance  for  lessons  learned  separate  from  oversight  procedures. 

Management  Comments.  The  IG  NRO  concurred  with  the  recommendation. 

Transmittal  Memorandum  for  the  FY  2002  Financial  Statement  Audits.  In  its  memorandum 
transmitting  the  FY  2002  financial  statement  audit  report,  the  IG  NRO  expressed  agreement  with 
the  IPA  opinion,  findings,  and  conclusions.  However,  the  transmittal  memorandum  did  not 
clearly  indicate  to  what  extent  the  OAIGA  perfonned  the  contractor  oversight  and  quality 
assurance  review  and  any  limitations  on  that  review.  The  transmittal  memorandum  also  did  not 
acknowledge  that  the  IPA  had  not  completed  all  its  working  papers  at  the  time  it  had  provided  its 
opinion.  For  example,  the  working  papers  documenting  the  OAIGA  oversight  of  the  IPA 
contract  audit  staff  for  the  FY  2002  financial  statements  audit  state  that  the  Office  of  the 
Inspector  General  did  not  have  sufficient  time  to  ascertain  whether  all  findings  were  supported  or 
whether  all  significant  matters  had  been  included  in  the  report.  Despite  the  statement  in  the 
working  papers,  the  audit  report  did  not  include  a  scope  limitation  and  the  known  effect  on  the 
audit  results  in  accordance  with  GAS,  paragraph  3.29  (1994  version).  In  addition,  the  contractor 
had  not  completed  its  working  papers  before  issuing  its  reports.  This  is  contrary  to  the  2003 
revision  to  GAS. 

Based  on  discussion  during  our  review,  the  Assistant  Inspector  General  for  Audits  revised  the 
transmittal  letter  to  eliminate  any  confusion  and  now  states  that  the  Office  of  the  Inspector 
General  conducted  sufficient  review  of  the  IPA  work  in  order  to  satisfy  themselves  that  the  audit 
opinion  is  supported. 
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Appendix  C.  Report  Distribution 


Other  Defense  Organizations 

Director,  National  Reconnaissance  Office 

Inspector  General,  National  Reconnaissance  Office 

Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Anned  Services 
House  Committee  on  Government  Reform 

House  Subcommittee  on  Government  Efficiency,  Financial  Management,  and 
Intergovernmental  Relations,  Committee  on  Government  Reform 
House  Subcommittee  on  National  Security,  Veterans  Affairs,  and  International 
Relations,  Committee  on  Government  Reform 
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National  Reconnaissance  Office 
Comments 


NATIONAL  RECONNAISSANCE  OFFICE 

14675  Lee  Road 
Chantilly,  VA  20151-1715 

Office  of  Inspector  General 


24  May  2004 


MEMORANDUM  FOR  ASSISTANT  INSPECTOR  GENERAL  FOR  POLICY  AND 
OVERSIGHT 

SUBJECT-.  Response  to  the  Quality  Control  Review  of  the  National 
Reconnaissance  Office,  Office  of  Inspector  General, 
Assistant  Inspector  General  for  Audits 

We  have  reviewed  the  Peer  Review  Report  dated  9  March  2004, 
as  amended  on  21  May  2004  and  offer  the  attached  comments.  We 
appreciate  the  "unqualified"  opinion  reached  by  your  review 
team.  Since  the  prior  peer  review  in  1998,  this  office  has 
strived  to  address  identified  weaknesses,  established  quality 
control  procedures,  and  conducted  quality  audits  in  support  of 
the  National  Reconnaissance  Office  mission.  Your  positive 
review  demonstrates  that  we  have  been  successful  in  these 
efforts . 

If  you  have  any  questions,  please  contact  Mr.  Robert 
Vignola,  Assistant  Inspector  General  for  Audits,  at 
(703]  008-2254 . 


Eric  R.  Feldman 
Inspector  General 


Attachment : 

Response  to  Peer  Review 
Report  dated  9  March  2004 
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ATTACHMENT 
Page  1  of  5 

Qualification  Requirements  for  national  Reconnaissance  Office 
Audit  Staff 

The  Peer  Review  team  identified  one  member  of  the  NRO  OIG  audit 
staff  classified  as  an  auditor  who  did  not  meet  the  usual 
auditor  requirements  for  the  C1A/NR0.  The  Peer  Review  team 
believes  that  the  OIG  should  have  well  defined  and  consistent 
minimum  standards  for  its  positions  in  order  to  continue  to  meet 
its  competency  standard. 

peGI-  Review  Recommendation :  Rc ■ designate  the  individual  who 
does  not  meet  the  basic  auditor  requirements  to  a  position 
designation  more  in  line  with  the  individual's  education  and 
experience. 

NRO  IG  Response:  Non-concur.  Although  we  mutually  agree  that 
it  is  appropriate  and  beneficial  to  have  technical  expertise  on 
the  audit  staff,  we  cannot  concur  with  this  recommendation. 

The  individual  in  question  was  hired  as  a  part-time  employee 
for  her  specific  expertise  in  information  systems. 

Nevertheless,  it  is  our  view  that  she  meets  the  OPM  defined 
standard  with  a  combination  of  30  semester  hours  in  accounting, 
economics,  and  business,  as  well  as  experience  in  professional 
accounting.  However,  neither  the  new  nor  the  former  CIA 
personnel  management  systems  afford  us  the  flexibility  to 
designate  the  individual  as  anything  but  an  auditor.  Under  the 
system,  an  individual  assigned  to  the  audit  staff  is 
designated  either  as  an  entry,  developmental,  full  performance, 
senior  or  expert  auditor.  There  is  no  GS  grade  or  OPM  job 
series  designation.  Placement  in  a  given  level  is  dependent  on 
the  individual's  demonstrated  experience,  including  education. 
Furthermore,  specific  performance  objectives  will  be  developed 
for  each  individual.  Through  this  process  we  can  ensure  that 
this  individual's  work  assignments  are  commensurate  with  their 
skill  levels. 

Peer  Review  Recommendation:  Establish  consistent  minimum 
qualifications  of  its  staff  members  in  accordance  with  PCIE 
standards . 

NRO  IG  Response:  Concur  in  principle.  The  new  CIA  system  will 
include  detailed  position  descriptions,  performance  standards 
and  promotion  criteria  that  address  the  entry  through  expert 
level  auditor.  The  position  descriptions  and  any  vacancy 
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Final  Report 
Reference 
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announcements  will  include  minimum  education  qualifications,  to 
include  Bachelor's  degree  in  a  relevant  area  of  study,  such  as 
Accounting,  Finance,  Information  Technology,  or  business,  as 
well  as  audit  experience  requirements . 


Qualifications  of  Independent  Public  Accountant  Staff 

The  Peer  Review  noted  that  the  Independent  Public  Accountant 
(IPA)  contractor  had  a  pattern  of  replacing  assigned  staff  with 
other  staff  who  had  lower  qualifications  inconsistent  with 
contract  requirements. 

Peer  Review  Recommendation:  Establish  procedures  that  provide 
for  additional  oversight  if  future  events  lead  to  accepting 
contracted  auditors  who  do  not  meet  contractual  requirements. 

NRO  16  Response:  Concur  in  principle.  The  existing  Statement 
of  Work  (SOW)  sections  9.0  -  9.4  already  include  these 
procedures.  We  believe  these  procedures  are  adequate  but  will 
reexamine  them  before  issuing  the  next  contract. 

Peer  Review  Recommendation:  Include  in  its  contract  for  audit 
services  provisions  to  ensure  additional  IPA  oversight  of  audits 
if  future  events  lead  to  accepting  contracted  auditors  that  do 
not  meet  contractual  requirements. 

NRO  IG  Response:  Concur  in  principle.  As  stated  above,  the 
existing  Statement  of  Work  sections  9.0  -  9.4  already  include 
these  procedures.  Those  procedures  effectively  allowed  us  to 
increase  the  number  of  hours  of  IPA  management  to  ensure 
contractor  performance . 

Peer  Review  Recommendation;  Consider  deleting  Clause  1-12 
specifying  that  all  proposed  substitutes  for  key  personnel  have 
qualifications  that  are  equal  to  or  higher  than  the 
qualifications  of  the  person  to  be  replaced. 

NRO  IG  Response:  Non- concur.  This  clause  is  required  by  the 
NRO  Acquisition  Manual  and  cannot  be  deleted.  However,  we  are 
evaluating  our  key  personnel  needs  for  the  next  contract,  which 
should  enable  us  to  appropriately  manage  this  process. 
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Peer  Review  Recommendation:  Ensure  the  contract  is  properly 
modified  and  consideration  provided  to  reflect  changes  in 
requirements  during  the  course  of  the  contract* 

NRO  IG  Response:  Non- concur.  The  subject  contract  ends  January 
2005,  so  there  is  little  value  to  modifying  it.  In  our  view, 
the  NRO  had  received  appropriate  consideration  for  the 
replacement  personnel.  As  the  peer  review  team  was  informed, 
the  rates  used  are  commensurate  with  the  experience  and 
certification  levels  of  each  individual.  The  NRO  OIG  believes 
that  we  received  the  same  or  better  quality  at  a  lower  rate. 


NRO  Staff  Independence  Guidance 

The  Peer  Review  team  observed  through  their  review  of  the  audit 
workpapers  that  NRO  OIG  auditors  notified  their  managers  of 
conflicts  of  interest  (COI) .  The  team  believes  that  the  OIG 
should  establish  a  more  proactive  process  for  identifying 
potential  conflicts,  and  develop  procedures  for  reporting 
changes  in  COI  status.  The  team  also  noted  that  the  audit 
manual  does  not  address  the  safeguards  that  must  be  in  place  in 
the  event  that  non-audit  work  is  done. 

Review  Recommendation:  We  recommend  that  the  Assistant 
Inspector  General  for  Audits  revise  and  strengthen  procedures  to 
provide  more  proactive  quality  control  procedures  to  comply  with 
GAS  independence  standard  and  include  procedures  and  process  to 
safeguard  personal  and  organizational  independence  relative  to 
non-audit  work. 

NRO  IG  Response:  Concur.  We  will  amend  our  audit  manual  to 
fully  reflect  the  updates  concerning  auditor  independence 
included  in  the  revised  Government  Audit  Standards  effective  on 
1  January  2004.  However,  we  do  not  agree  that  our  existing 
procedures  are  not  proactive  since  that  is  how  the  noted 
instances  were  revealed.  Although  the  Audit  Staff  has  not  and 
is  unlikely  to  conduct  non-audit  work  in  the  future,  we  will 
include  procedures  in  our  manual  to  address  the  possibility  of 
doing  such  non- audit  work. 
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IPA  Independence  Documentation  Requirements 

The  Peer  Review  believes  that  the  OIG  should  require  its  IPA 
contractor  to  comply  with  the  Government  Auditing  Standards 
concerning  independence  and  made  the  following  recommendation: 

Peer  Review  Recommendation:  He  recommend  that  the  Assistant 
Inspector  General  for  Audits  include  in  its  statement  of  work 
for  audit  services  specific  requirements  for  complying  with  the 
Government  Auditing  Standard  on  Independence  and  required 
documentation  to  ensure  that  the  organization  as  well  as 
individual  auditors  are  complying  with  the  independence 
standard.  The  Statement  of  Work  should  include  compliance  with 
standards  related  to  non-audit  work  by  both  the  organization  and 
the  individual  auditors  related  to  the  audit  objectives  and  NRO. 

NRO  IG  Response:  Concur.  For  the  next  IPA  contract,  we  will 
modify  the  Statement  of  Work  to  reflect  the  updated  Government 
Auditing  Standards  requirements  concerning  auditor  independence. 
With  regards  to  non-audit  work,  the  IPA  will  not  be  performing 
any  non-audit  work  as  part  of  this  contract . 

Financial  statement  Audit-Contractor  Oversight  and  Quality 
Assurance  Working  Papers  and  Quality  Assurance  Plan 

The  Peer  Review  noted  that  "the  majority  of  NRO  IG  contractor 
oversight  and  quality  assurance  workpapers  were  not  prepared  and 
reviewed  until  after  the  audit  report  on  the  FY  2002  financial 
statements  and  transmittal  memorandum"  were  issued  in  January 
2003. 

Peer  Review  Recommendation:  The  Assistant  inspector  General  for 
Audits  revise  its  oversight  procedures  to  ensure  documentation 
of  its  oversight  is  complete  before  issuing  its  transmittal 
report  accepting  the  contractor's  opinions,  conclusions,  and 
recommendations  relative  to  its  contracted  audit  services  and 
perform  quality  assurance  procedures  that  are  acceptable  to 
perform  after  report  issuance  for  lessons  learned  separate  from 
oversight  procedures. 

NRO  IG  Comments:  The  Peer  Review  statements  do  not  properly 
explain  the  condition.  At  the  time  the  audit  report  is  issued 
and  transmitted,  all  IPA  workpapers  are  complete.  Our 
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responsibility  up  to  that  point  is  to  provide  oversight  of  the 
IPA'e  work  and  to  ensure  that  sufficient  testing  has  been 
performed  to  support  their  opinion.  Once  the  report  has  been 
issued  and  transmitted,  the  quality  assurance  of  the  IPA's 
workpapers  is  completed. 

HRO  ig  Response:  Concur.  In  order  to  clarify  this  process,  we 
will  divide  the  Quality  Assurance  Program  (QAP)  into  two  parts: 
oversight  and  quality  assurance.  The  oversight  part  will 
reflect  the  requirements  outlined  in  the  GAO/PCIE  Financial 
Audit  Manual,  section  650,  'Using  the  Work  of  Others,'  and  will 
be  completed  prior  to  issuance  of  the  report.  The  quality 
assurance  part  of  the  QAP  will  be  performed  after  the  report  is 
issued  and  will  form  the  basis  for  best  practices  or  lessons 
learned. 
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